<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en-US">
<head>
<!-- GenHTML revision 25226-->
<meta http-equiv="Content-type" content="text/html; charset=utf-8">
<title>Securing Application Clients - The Java EE 6 Tutorial</title>
<meta name="robots" content="index,follow">
<meta name="robots" content="index,follow">
<meta name="date" content="2011-03-01">
<link rel="stylesheet" type="text/css" href="css/default.css">
<link rel="stylesheet" type="text/css" href="css/ipg.css">
<link rel="stylesheet" type="text/css" href="css/javaeetutorial.css">
</head>

<body>

<table border="0" cellpadding="5" cellspacing="0" width="100%">
<tbody>
   <tr valign="top">
      <td width="400px"><p class="toc level1"><a href="docinfo.html">Document Information</a></p>
<p class="toc level1 tocsp"><a href="gexaf.html">Preface</a></p>
<p class="toc level1 tocsp"><a href="gfirp.html">Part&nbsp;I&nbsp;Introduction</a></p>
<p class="toc level2"><a href="bnaaw.html">1.&nbsp;&nbsp;Overview</a></p>
<p class="toc level2"><a href="gfiud.html">2.&nbsp;&nbsp;Using the Tutorial Examples</a></p>
<p class="toc level1 tocsp"><a href="bnadp.html">Part&nbsp;II&nbsp;The Web Tier</a></p>
<p class="toc level2"><a href="bnadr.html">3.&nbsp;&nbsp;Getting Started with Web Applications</a></p>
<p class="toc level2"><a href="bnaph.html">4.&nbsp;&nbsp;JavaServer Faces Technology</a></p>
<p class="toc level2"><a href="giepx.html">5.&nbsp;&nbsp;Introduction to Facelets</a></p>
<p class="toc level2"><a href="gjddd.html">6.&nbsp;&nbsp;Expression Language</a></p>
<p class="toc level2"><a href="bnaqz.html">7.&nbsp;&nbsp;Using JavaServer Faces Technology in Web Pages</a></p>
<p class="toc level2"><a href="gjcut.html">8.&nbsp;&nbsp;Using Converters, Listeners, and Validators</a></p>
<p class="toc level2"><a href="bnatx.html">9.&nbsp;&nbsp;Developing with JavaServer Faces Technology</a></p>
<p class="toc level2"><a href="gkmaa.html">10.&nbsp;&nbsp;JavaServer Faces Technology Advanced Concepts</a></p>
<p class="toc level2"><a href="bnawo.html">11.&nbsp;&nbsp;Configuring JavaServer Faces Applications</a></p>
<p class="toc level2"><a href="gkiow.html">12.&nbsp;&nbsp;Using Ajax with JavaServer Faces Technology</a></p>
<p class="toc level2"><a href="gkhxa.html">13.&nbsp;&nbsp;Advanced Composite Components</a></p>
<p class="toc level2"><a href="bnavg.html">14.&nbsp;&nbsp;Creating Custom UI Components</a></p>
<p class="toc level2"><a href="bnafd.html">15.&nbsp;&nbsp;Java Servlet Technology</a></p>
<p class="toc level2"><a href="bnaxu.html">16.&nbsp;&nbsp;Internationalizing and Localizing Web Applications</a></p>
<p class="toc level1 tocsp"><a href="bnayk.html">Part&nbsp;III&nbsp;Web Services</a></p>
<p class="toc level2"><a href="gijti.html">17.&nbsp;&nbsp;Introduction to Web Services</a></p>
<p class="toc level2"><a href="bnayl.html">18.&nbsp;&nbsp;Building Web Services with JAX-WS</a></p>
<p class="toc level2"><a href="giepu.html">19.&nbsp;&nbsp;Building RESTful Web Services with JAX-RS</a></p>
<p class="toc level2"><a href="gjjxe.html">20.&nbsp;&nbsp;Advanced JAX-RS Features</a></p>
<p class="toc level2"><a href="gkojl.html">21.&nbsp;&nbsp;Running the Advanced JAX-RS Example Application</a></p>
<p class="toc level1 tocsp"><a href="bnblr.html">Part&nbsp;IV&nbsp;Enterprise Beans</a></p>
<p class="toc level2"><a href="gijsz.html">22.&nbsp;&nbsp;Enterprise Beans</a></p>
<p class="toc level2"><a href="gijre.html">23.&nbsp;&nbsp;Getting Started with Enterprise Beans</a></p>
<p class="toc level2"><a href="gijrb.html">24.&nbsp;&nbsp;Running the Enterprise Bean Examples</a></p>
<p class="toc level2"><a href="bnbpk.html">25.&nbsp;&nbsp;A Message-Driven Bean Example</a></p>
<p class="toc level2"><a href="gkcqz.html">26.&nbsp;&nbsp;Using the Embedded Enterprise Bean Container</a></p>
<p class="toc level2"><a href="gkidz.html">27.&nbsp;&nbsp;Using Asynchronous Method Invocation in Session Beans</a></p>
<p class="toc level1 tocsp"><a href="gjbnr.html">Part&nbsp;V&nbsp;Contexts and Dependency Injection for the Java EE Platform</a></p>
<p class="toc level2"><a href="giwhb.html">28.&nbsp;&nbsp;Introduction to Contexts and Dependency Injection for the Java EE Platform</a></p>
<p class="toc level2"><a href="gjbls.html">29.&nbsp;&nbsp;Running the Basic Contexts and Dependency Injection Examples</a></p>
<p class="toc level2"><a href="gjehi.html">30.&nbsp;&nbsp;Contexts and Dependency Injection for the Java EE Platform: Advanced Topics</a></p>
<p class="toc level2"><a href="gkhre.html">31.&nbsp;&nbsp;Running the Advanced Contexts and Dependency Injection Examples</a></p>
<p class="toc level1 tocsp"><a href="bnbpy.html">Part&nbsp;VI&nbsp;Persistence</a></p>
<p class="toc level2"><a href="bnbpz.html">32.&nbsp;&nbsp;Introduction to the Java Persistence API</a></p>
<p class="toc level2"><a href="gijst.html">33.&nbsp;&nbsp;Running the Persistence Examples</a></p>
<p class="toc level2"><a href="bnbtg.html">34.&nbsp;&nbsp;The Java Persistence Query Language</a></p>
<p class="toc level2"><a href="gjitv.html">35.&nbsp;&nbsp;Using the Criteria API to Create Queries</a></p>
<p class="toc level2"><a href="gkjiq.html">36.&nbsp;&nbsp;Creating and Using String-Based Criteria Queries</a></p>
<p class="toc level2"><a href="gkjjf.html">37.&nbsp;&nbsp;Controlling Concurrent Access to Entity Data with Locking</a></p>
<p class="toc level2"><a href="gkjia.html">38.&nbsp;&nbsp;Improving the Performance of Java Persistence API Applications By Setting a Second-Level Cache</a></p>
<p class="toc level1 tocsp"><a href="gijrp.html">Part&nbsp;VII&nbsp;Security</a></p>
<p class="toc level2"><a href="bnbwj.html">39.&nbsp;&nbsp;Introduction to Security in the Java EE Platform</a></p>
<p class="toc level2"><a href="bncas.html">40.&nbsp;&nbsp;Getting Started Securing Web Applications</a></p>
<p class="toc level2"><a href="bnbyk.html">41.&nbsp;&nbsp;Getting Started Securing Enterprise Applications</a></p>
<p class="toc level3"><a href="bnbyl.html">Securing Enterprise Beans</a></p>
<p class="toc level4"><a href="bnbyl.html#gjgdi">Securing an Enterprise Bean Using Declarative Security</a></p>
<p class="toc level5"><a href="bnbyl.html#gjgcq">Specifying Authorized Users by Declaring Security Roles</a></p>
<p class="toc level5"><a href="bnbyl.html#bnbyu">Specifying an Authentication Mechanism and Secure Connection</a></p>
<p class="toc level4 tocsp"><a href="bnbyl.html#gjgcs">Securing an Enterprise Bean Programmatically</a></p>
<p class="toc level5"><a href="bnbyl.html#gjgcr">Accessing an Enterprise Bean Caller's Security Context</a></p>
<p class="toc level4 tocsp"><a href="bnbyl.html#bnbyr">Propagating a Security Identity (Run-As)</a></p>
<p class="toc level5"><a href="bnbyl.html#bnbzb">Configuring a Component's Propagated Security Identity</a></p>
<p class="toc level5"><a href="bnbyl.html#bnbzc">Trust between Containers</a></p>
<p class="toc level4 tocsp"><a href="bnbyl.html#bnbzg">Deploying Secure Enterprise Beans</a></p>
<p class="toc level3 tocsp"><a href="gkbsz.html">Examples: Securing Enterprise Beans</a></p>
<p class="toc level4"><a href="gkbsz.html#bnbzk">Example: Securing an Enterprise Bean with Declarative Security</a></p>
<p class="toc level5"><a href="gkbsz.html#bnbzl">Annotating the Bean</a></p>
<p class="toc level5"><a href="gkbsz.html#bnbzn">To Build, Package, Deploy, and Run the Secure Cart Example Using NetBeans IDE</a></p>
<p class="toc level5"><a href="gkbsz.html#bnbzo">To Build, Package, Deploy, and Run the Secure Cart Example Using Ant</a></p>
<p class="toc level4 tocsp"><a href="gkbsz.html#bncaa">Example: Securing an Enterprise Bean with Programmatic Security</a></p>
<p class="toc level5"><a href="gkbsz.html#bncab">Modifying <tt>ConverterBean</tt></a></p>
<p class="toc level5"><a href="gkbsz.html#gkbsi">Modifying <tt>ConverterServlet</tt></a></p>
<p class="toc level5"><a href="gkbsz.html#bncad">To Build, Package, and Deploy the Secure Converter Example Using NetBeans IDE</a></p>
<p class="toc level5"><a href="gkbsz.html#bncae">To Build, Package, and Deploy the Secure Converter Example Using Ant</a></p>
<p class="toc level5"><a href="gkbsz.html#gjtdp">To Run the Secure Converter Example</a></p>
<div id="scrolltoc" class="onpage">
<p class="toc level3 tocsp"><a href="">Securing Application Clients</a></p>
<p class="toc level4"><a href="#bncai">Using Login Modules</a></p>
<p class="toc level4"><a href="#bncaj">Using Programmatic Login</a></p>
</div>
<p class="toc level3 tocsp"><a href="bncal.html">Securing Enterprise Information Systems Applications</a></p>
<p class="toc level4"><a href="bncal.html#bncam">Container-Managed Sign-On</a></p>
<p class="toc level4"><a href="bncal.html#bncan">Component-Managed Sign-On</a></p>
<p class="toc level4"><a href="bncal.html#bncao">Configuring Resource Adapter Security</a></p>
<p class="toc level4"><a href="bncal.html#bncap">To Map an Application Principal to EIS Principals</a></p>
<p class="toc level1 tocsp"><a href="gijue.html">Part&nbsp;VIII&nbsp;Java EE Supporting Technologies</a></p>
<p class="toc level2"><a href="gijto.html">42.&nbsp;&nbsp;Introduction to Java EE Supporting Technologies</a></p>
<p class="toc level2"><a href="bncih.html">43.&nbsp;&nbsp;Transactions</a></p>
<p class="toc level2"><a href="bncjh.html">44.&nbsp;&nbsp;Resource Connections</a></p>
<p class="toc level2"><a href="bncdq.html">45.&nbsp;&nbsp;Java Message Service Concepts</a></p>
<p class="toc level2"><a href="bncgv.html">46.&nbsp;&nbsp;Java Message Service Examples</a></p>
<p class="toc level2"><a href="gkahp.html">47.&nbsp;&nbsp;Advanced Bean Validation Concepts and Examples</a></p>
<p class="toc level2"><a href="gkeed.html">48.&nbsp;&nbsp;Using Java EE Interceptors</a></p>
<p class="toc level1 tocsp"><a href="gkgjw.html">Part&nbsp;IX&nbsp;Case Studies</a></p>
<p class="toc level2"><a href="gkaee.html">49.&nbsp;&nbsp;Duke's Tutoring Case Study Example</a></p>
<p class="toc level1 tocsp"><a href="idx-1.html">Index</a></p>
</td>
      <td width="10px">&nbsp;</td>
      <td>
         <div class="header">
             <div class="banner">
                <table width="100%" border="0" cellpadding="5" cellspacing="0">
                   <tbody>
                      <tr>
                         <td valign="bottom"><p class="Banner">The Java EE 6 Tutorial
</p></td>
                         <td align="right"  valign="bottom"><img src="graphics/javalogo.png" alt="Java Coffee Cup logo"></td>
                      </tr>
                   </tbody>
                </table>
             </div>

             <div class="header-links">
	         <a href="./index.html">Home</a> | 
<a href="../information/download.html">Download</a> | 
<a href="./javaeetutorial6.pdf">PDF</a> | 
<a href="../information/faq.html">FAQ</a> | 
<a href="http://download.oracle.com/javaee/feedback.htm">Feedback</a>

             </div>
             <div class="navigation">
                 <a href="gkbsz.html"><img src="graphics/leftButton.gif" border="0" alt="Previous" title="Previous"></a>
                 <a href="p1.html"><img src="graphics/upButton.gif" border="0" alt="Contents" title="Contents"></a>
                 <a href="bncal.html"><img src="graphics/rightButton.gif" border="0" alt="Next" title="Next"></a>
             </div>
         </div>

	 <div class="maincontent">      	 
             

<a name="bncah"></a><h2>Securing Application Clients</h2>
<a name="indexterm-2163"></a><a name="indexterm-2164"></a><a name="indexterm-2165"></a><p>The Java EE authentication requirements for application clients are the same as for
other Java EE components, and the same authentication techniques can be used as
for other Java EE application components. No authentication is necessary when accessing unprotected
web resources. </p>

<p>When accessing protected web resources, the usual varieties of authentication can be used:
HTTP basic authentication, SSL client authentication, or HTTP login-form authentication. These authentication methods
are discussed in <a href="gkbaa.html#bncbn">Specifying an Authentication Mechanism in the Deployment Descriptor</a>.</p>

<p>Authentication is required when accessing protected enterprise beans. The authentication mechanisms for enterprise
beans are discussed in <a href="bnbyl.html">Securing Enterprise Beans</a>.</p>

<p>An application client makes use of an authentication service provided by the application
client container for authenticating its users. The container&rsquo;s service can be integrated with
the native platform&rsquo;s authentication system, so that a single sign-on capability is used.
The container can authenticate the user either when the application is started or
when a protected resource is accessed.</p>

<p><a name="indexterm-2166"></a><a name="indexterm-2167"></a><a name="indexterm-2168"></a>An application client can provide a class, called a login module, to gather
authentication data. If so, the <tt>javax.security.auth.callback.CallbackHandler</tt> interface must be implemented, and the class
name must be specified in its deployment descriptor. The application&rsquo;s callback handler must
fully support <tt>Callback</tt> objects specified in the <tt>javax.security.auth.callback</tt> package.</p>



<a name="bncai"></a><h3>Using Login Modules</h3>
<a name="indexterm-2169"></a><a name="indexterm-2170"></a><a name="indexterm-2171"></a><a name="indexterm-2172"></a><p>An application client can use the Java Authentication and Authorization Service (JAAS) to
create <b>login modules</b> for authentication. A JAAS-based application implements the <tt>javax.security.auth.callback.CallbackHandler</tt> interface so that
it can interact with users to enter specific authentication data, such as user
names or passwords, or to display error and warning messages.</p>

<p>Applications implement the <tt>CallbackHandler</tt> interface and pass it to the login context, which
forwards it directly to the underlying login modules. A login module uses the
callback handler both to gather input, such as a password or smart card
PIN, from users and to supply information, such as status information, to users.
Because the application specifies the callback handler, an underlying login module can remain
independent of the various ways that applications interact with users.</p>

<p>For example, the implementation of a callback handler for a GUI application might
display a window to solicit user input. Or the implementation of a
callback handler for a command-line tool might simply prompt the user for input
directly from the command line.</p>

<p>The login module passes an array of appropriate callbacks to the callback handler&rsquo;s
<tt>handle</tt> method, such as a <tt>NameCallback</tt> for the user name and a
<tt>PasswordCallback</tt> for the password; the callback handler performs the requested user interaction and sets
appropriate values in the callbacks. For example, to process a <tt>NameCallback</tt>, the
<tt>CallbackHandler</tt> might prompt for a name, retrieve the value from the user, and
call the <tt>setName</tt> method of the <tt>NameCallback</tt> to store the name.</p>

<p><a name="indexterm-2173"></a><a name="indexterm-2174"></a>For more information on using JAAS for login modules for authentication, refer to
the following sources (see <a href="bnbyj.html">Further Information about Security</a> for the URLs):</p>


<ul><li><p><i>Java Authentication and Authorization Service (JAAS) Reference Guide</i></p>

</li>
<li><p><i>Java Authentication and Authorization Service (JAAS): LoginModule Developer&rsquo;s Guide</i></p>

</li></ul>


<a name="bncaj"></a><h3>Using Programmatic Login</h3>
<a name="indexterm-2175"></a><p>Programmatic login enables the client code to supply user credentials. If you are
using an EJB client, you can use the <tt>com.sun.appserv.security.ProgrammaticLogin</tt> class with its
convenient <tt>login</tt> and <tt>logout</tt> methods. Programmatic login is specific to a server.</p>


         </div>
         <div class="navigation">
             <a href="gkbsz.html"><img src="graphics/leftButton.gif" border="0" alt="Previous" title="Previous"></a>
             <a href="p1.html"><img src="graphics/upButton.gif" border="0" alt="Contents" title="Contents"></a>
             <a href="bncal.html"><img src="graphics/rightButton.gif" border="0" alt="Next" title="Next"></a>
         </div>

         <div class="copyright">
      	    <p>Copyright &copy; 2011, Oracle and/or its affiliates. All rights reserved. <a href="docinfo.html">Legal Notices</a></p>
      	 </div>

      </td>
   </tr>
</tbody>
</table>
</body>
</html>

